7 - Malicious Code

Question 1

Botnets

Answer 1

Network of computers infected by malicious code

C2 is a control server or machine that relays with individual bots

Extract info, Ddos, etc

Question 2

APT

Answer 2

Targeted at individual organizations

Low and slow

Unique

Question 3

Malware analysis

Answer 3

Static - what would happen if executed

Dynamic

• different granularity
• execute the program

Question 4

Viruses, backdoors, logic bombs, Trojan horses, worms

Answer 4

Virus - infect program by modifying it and then self copy

Backdoor - secret entry point into program or system

Logic bomb - wait and perform malicious activity when activated

Trojan horse - hidden in useful program, executes when main program is run

Worm - use network connections to spread, exploiting vulnerability